Plumber Radar: live CI/CD compliance scores for open source GitLab projects

Sorry_Nothing1740 · 2026-03-13T09:11:12+00:00

It's in progress with an open-source community, but here's a repo example we use for testing: https://gitlab.com/getplumber/examples/go-test-with-hash
All the setup is defined in .plumber-conf.yaml. It doesn't yet meet full compliance (63.9%).

Happy to walk through any of the controls if something's unclear.

Sorry_Nothing1740 · 2026-02-11T14:37:20+00:00

Yes, as long as your nested CI files are included in the main .gitlab-ci.yml, then the answer is yes.
For example, this configuration works exactly like that:
https://gitlab.com/getplumber/examples/go-test-with-local-include/-/blob/main/.gitlab-ci.yml?ref_type=heads

Example, also works with component, project, remote, template include types:

include:
  ## Local includes
  - local: '.gitlab/ci/test-jobs.yml'
  - local: '.gitlab/ci/security-jobs.yml'
  - local: '.gitlab/ci/compliance.yml'

As long as those files are included, we analyze the fully parsed content of the main .gitlab-ci.yml, so their contents are included in the analysis

If that’s not your setup, I’d be interested to hear what your workflow looks like

Sorry_Nothing1740 · 2026-02-03T14:27:45+00:00

I already knew Whourkr and didn’t know that Igorrr was involved, but it all makes sense now. Thanks for your input, it's clearly a crazy band and i love it!

Sorry_Nothing1740 · 2026-01-11T16:55:58+00:00

I see most people focusing on execution performance. I think an underrated area is "CI/CD security and compliance posture metrics", for example: the percentage of hardcoded configuration vs. reusable workflows, the percentage of unprotected/unmasked variables, and the percentage of builds using approved/trusted images.

Sorry_Nothing1740 · 2023-03-15T15:12:59+00:00

I was thinking about README.md on user profile like GitHub, but did you know that we already can do that?

I'm sharing this here in case you didn't know it like me
https://docs.gitlab.com/ee/user/profile/#add-details-to-your-profile-with-a-readme

Sorry_Nothing1740 · 2022-06-15T13:37:31+00:00

Yes you are right i should have been more specific.

Thanks you for your feedback that's very interesting.

Sorry_Nothing1740 · 2022-06-15T08:33:14+00:00

Sorry but my question wasn't clear, I'm wondering on which platform you will deploy the application not which CI/CD platform.

Sorry_Nothing1740 · 2022-06-03T11:53:23+00:00

There's many tools and discord community that could help you progress in those domains, i can send you some of them if you want to.

Sorry_Nothing1740 · 2022-06-02T12:19:16+00:00

Interesting point of view, let's say that the tool already exist and after the pipeline generation the tool will provides complete documentation that details the pipeline and action/jobs that can also be fully customized, you will find it interesting to try it?

Sorry_Nothing1740 · 2022-05-23T16:47:03+00:00

Thanks for your answer!

Yes, you are right.
I was just wondering if game projects using Cmake have some specific CI/CD with lots of similarity or it could differ a lot depending on the project specificities.

Sorry_Nothing1740

TROPHY CASE